Leveraging AI for Real-Time Threat Intelligence and Incident Response in Multi-Cloud Environments

The healthcare information system (HIS) has become a victim of cyberattacks. Traditional ways to handle cyber incidents in healthcare organizations follow a predefined incident response (IR) procedure. However, this procedure is usually reactive, missing the opportunities to foresee danger on the horizon. Cyber threat intelligence (CTI) contains information on emerging attacks and should be ideally utilized to inform the IR procedure. However, current research shows that the IR has not been effectively informed by CTI, especially in healthcare organizations. This paper fills in this gap by proposing a proactive IR response procedure based on the National Institute of Standards and Technology (NIST) IR methodology. This paper then presents the NHS WannaCry case study to demonstrate the use of the proposed IR methodology. We collate cyber security advisories from different CTI sources such as US/UK CERT to protect interconnected systems and devices from Ransomware attacks. This research provides novel insights into the IR in healthcare through embedding CTI advisories into IR processes and concludes that our proposed IR procedure can be used to counteract WannaCry Ransomware using CTI advisories. It has the significance of transforming the way of IR from reactive to proactive using the CTI in healthcare.

As enterprises increasingly migrate workloads to cloud platforms, the threat landscape has evolved with greater sophistication and velocity. Traditional reactive security models, reliant on post-incident response, are insufficient to address modern attack vectors such as identity compromise, misconfigured cloud services, and lateral movement within hybrid environments. This study proposes a Proactive Threat Intelligence and Detection Model leveraging cloud-native security tools to provide real-time monitoring, early threat identification, and automated mitigation. The model integrates threat intelligence feeds, machine learning, and anomaly detection to deliver predictive insights, enabling organizations to act before threats materialize into security incidents. The model begins with a data collection phase, centralizing telemetry from cloud workloads, applications, network logs, and identity services. External threat intelligence feeds augment internal data, enriching the context for detection. In the analysis phase, AI-driven correlation and behavioral analytics identify deviations from normal activity, flagging potential indicators of compromise (IoCs) and suspicious patterns. Risk scoring and prioritization mechanisms allow security teams to focus on high-impact threats, reducing alert fatigue and optimizing resource allocation. The response phase incorporates automated remediation, such as account suspension, workload isolation, or conditional access enforcement, while retaining human-in-the-loop oversight for complex scenarios. Continuous monitoring and feedback loops refine detection algorithms over time, adapting to evolving threats and organizational changes. By leveraging cloud-native security platforms—such as Microsoft Defender, AWS GuardDuty, or Google Chronicle—the model provides scalable, integrated, and real-time security coverage across IaaS, PaaS, and SaaS environments. This proactive approach enhances enterprise resilience by shifting from reactive incident response to predictive threat management. The proposed model ensures early detection, minimizes operational disruption, and supports compliance with regulatory standards. Ultimately, it positions organizations to leverage cloud-native capabilities, integrate AI-driven threat intelligence, and maintain robust, adaptive, and proactive cybersecurity frameworks in complex, hybrid, and multi-cloud environments.

Modern enterprises rely on large scale database systems, distributed storage engines, and big data processing platforms to sustain transaction processing, analytics, and real time decision workloads that are critical to business continuity. As these environments expand across cloud regions, hybrid infrastructures, and highly dynamic workloads, traditional manual incident response approaches struggle to keep pace with the volume, velocity, and complexity of operational events, leading to delayed detection and prolonged recovery times. The integration of machine learning techniques with automated observability pipelines, telemetry aggregation, and control plane automation enables the emergence of self-healing infrastructures that continuously analyze logs, metrics, traces, and system signals to identify anomalies, correlate symptoms, and infer probable root causes with minimal human intervention. Intelligent remediation workflows can trigger actions such as workload rebalancing, failover orchestration, resource scaling, configuration correction, or query throttling, forming closed loop feedback systems that stabilize operations. This paper examines how advanced log analytics, adaptive feedback control mechanisms, and distributed stream processing frameworks support machine learning augmented incident response in database environments, illustrating through architectural patterns and practical scenarios how organizations can enhance operational resilience, minimize service disruptions, and maintain performance guarantees by adopting proactive and autonomous recovery strategies.

In this paper, we perform an analysis of SIP, a popular voice over IP (VoIP) protocol and propose a framework for capturing and analysing volatile VoIP data in order to determine forensic readiness requirements for effectively identifying an attacker. The analysis was performed on real attack data and the findings were encouraging. It seems that if appropriate forensic readiness processes and controls are in place, a wealth of evidence can be obtained. The type of the end user equipment of the internal users, the private IP, the software that is used can help build a reliable baseline information database. On the other hand the private IP addresses of the potential attacker even during the presence of NAT services, as well as and the attack tools employed by the malicious parties are logged for further analysis.

Background Organizations achieve agility, scalability, and enhanced resource utilization in multi-cloud environments, but face challenges in ensuring uniform and robust security across diverse cloud platforms. Variations in configuration and security mechanisms among providers hinder consistent policy enforcement and expose systems to data breaches and evasive threats. Additionally, the dynamic and distributed nature of multi-cloud operations broadens the attack surface, making real-time threat mitigation more complex. Methods To address these challenges, we introduced a groundbreaking software-defined networking (SDN)-enabled framework that incorporates deep learning for attack detection and adaptive security policy management. The framework consists of two primary components: the Software-Defined Multicloud Defense Controller (SDMDC), which enables centralized, real-time security policy enforcement (control plane), and the Multicloud Intrusion Detection System Gateways (MCIDS-G), which facilitate distributed threat detection across cloud platforms (data plane). The SDMDC’s integrated IDS is built using the Cross-Cloud Threat Transformer (CCTT) model, while the MCIDS-G’s regional IDS is based on the Long Short-Term Memory (LSTM) model. Additionally, the Lemurs Optimizer (LO) is employed in the SDMDC for cost-efficient policy management. SDMDC enforces security standards across all cloud environments where applications operate. Results The proposed solution addresses long-standing cloud security issues by combining coordinated global security strategies with automated threat detection and centralized policy management. SDMDC ensures consistent policy enforcement across cloud environments and manages ingress/egress and east–west traffic between cloud domains, including Amazon Web Service (AWS) and other service providers. The architecture supports dynamic resource orchestration and horizontal scalability, enabling adaptive performance under varying load conditions. The system also enables automatic policy implementation across platforms and facilitates real-time threat response to maintain consistent security. Conclusion The presented framework represents a significant advancement over existing multi-cloud protection solutions. It introduces new research directions, particularly in traffic management, firewall integration, and fully qualified domain name (FQDN) policy enforcement with proxy management.

Current threat intelligence systems often lack scalable, adaptive AI architectures capable of delivering real-time incident detection and dynamic response, particularly in resource-constrained environments. This paper presents a novel AI-driven architectural design for operational threat intelligence, specifically tailored to enhance cybersecurity in global and Kenyan judiciaries. The proposed model integrates three foundational frameworks, which are Integrated Adaptive Cyber Defence (IACD), the Cyber Kill Chain, and Moving Target Defence (MTD), into an architecture that supports real-time data ingestion, continuous AI model retraining, and automated response orchestration. The research design for this study adopts a mixed-methods approach, combining qualitative and quantitative methods to ensure a comprehensive understanding of the AI-driven operational Cyber Threat Intelligence (CTI) model. Key features include a dynamic feedback loop for adaptive learning, AI-powered multi-stage threat detection aligned with attack lifecycle mapping, and resource-efficient dynamic defence mechanisms suitable for low-resource judicial environments. This design significantly improves incident response capabilities by enabling faster, more accurate threat detection and automated mitigation, reducing mean time to detect and respond. By providing a scalable, transparent, and explainable AI model, the architecture offers a practical blueprint for enhancing cybersecurity resilience in judicial systems worldwide, with applicability to the unique challenges faced by Kenyan courts. This work lays the foundation for future extensions involving federated learning to enable secure, multi-court deployments, further strengthening collective judicial cybersecurity defences.

Kenyan universities are increasingly integrating digital technologies into their academic and administrative operations. However, this digital transformation has exposed institutions to escalating cybersecurity threats, including data breaches, ransomware attacks, and unauthorized access to critical information. This study evaluates the effectiveness of existing cybersecurity measures and incident management systems in Kenyan universities, aiming to identify key vulnerabilities and areas for improvement. A structured survey was conducted among IT personnel from four major Kenyan universities, gathering data on cybersecurity preparedness, existing frameworks, and incident response strategies. The findings indicate that while universities have implemented basic cybersecurity measures such as firewall protections and access controls, there are significant gaps in real-time threat detection, incident response preparedness, and cybersecurity training programs. Many institutions lack dedicated cybersecurity teams, and incident response mechanisms are largely reactive rather than proactive. Additionally, limited financial and technical resources hinder effective implementation of cybersecurity policies. This paper highlights critical deficiencies in cybersecurity frameworks currently in use and emphasizes the need for real-time monitoring systems, improved staff training, and the adoption of automated threat detection tools. The study recommends a multi-stakeholder approach involving universities, government agencies, and cybersecurity experts to enhance resilience against evolving cyber threats. Addressing these gaps will allow Kenyan universities can strengthen their cybersecurity posture, protect academic assets, and safeguard the privacy of students and faculty members. This research contributes to ongoing discussions on cybersecurity in higher education and provides a foundation for developing more effective cybersecurity policies and frameworks in African academic institutions.

The contribution of this paper is a comprehensive cybersecurity framework to secure cloud hosted Guidewire implementations by addressing critical security challenges such as threat detection, incident response, compliance, and system performance. Based on advanced technologies like machine learning, behavioral analytics and auto patching, the framework detects and mitigates known and unknown threats, incidentally zero-day exploit. The system does this through micro segmenting, behavioral anomaly detection, and automated patch orchestration in a way that does not render the system unperforming. Key performance metrics of threat detection time (less than 3 seconds), incident response (patching within 5 minutes) and system availability (99.95% uptime) are all tested as the framework outperforms in all of these. Additionally, the framework ascertains industry standards such as GDPR and HIPAA via automated audit trails and ongoing monitoring. Compared to the currently deployed cloud security, the proposed approach, with a special focus on more secure the Guidewire application deployed in the cloud, offers a multi layered security approach to the modules specific to the Guidewire. Though powerful, the framework also suffers from complexity in its deployment, overhead in terms of performance and a reliance on cloud provider-specific features. The scalability will need to improve, and the product will need to support multiple clouds and integrate advanced technology such as quantum computing and AI-powered threat intelligence. This work sets a solid basis for the protection of cloud-based Guidewire systems against future cyber threats while maintaining operational continuity and system compliance.

This research introduces an AI-augmented framework for proactive vulnerability management in cloud-native clusters, integrating real-time threat intelligence with automated DevSecOps workflows. The system continuously aggregates CVE data, analyzes exploit likelihood using advanced machine learning models, and dynamically injects remediation recommendations into Terraform and ArgoCD pipelines. By coupling predictive analytics with infrastructure-as-code automation, it enables continuous risk scoring, autonomous patch deployment, and contextual prioritization of vulnerabilities. Empirical evaluations across AWS, Azure, and GCP clusters demonstrate a 73% reduction in mean time to remediation (MTTR) and an 89% increase in vulnerability detection accuracy, outperforming conventional reactive methods. The framework’s low operational overhead (<4%) and seamless integration with GitOps workflows establish its practicality for large-scale, multi-cloud environments. The proposed approach advances the state of cloud security toward self-healing, AI-driven resilience and continuous compliance within distributed containerized ecosystems.

The Evolution of Cyber Resilience Frameworks in Network Security: A Conceptual Analysis provides a comprehensive overview of the development and application of cyber resilience frameworks in the context of network security. The report explores the evolution of cyber resilience concepts, the key components of cyber resilience frameworks, and their importance in mitigating cyber threats and ensuring business continuity. The report begins by tracing the evolution of cyber resilience from traditional cybersecurity approaches to more holistic, proactive strategies that address the dynamic nature of cyber threats. It highlights the shift from a focus on prevention to a focus on detection, response, and recovery, emphasizing the importance of resilience in maintaining operational continuity in the face of cyber attacks. The report then discusses the key components of cyber resilience frameworks, including risk assessment, threat intelligence, incident response, and recovery planning. It examines how these components work together to enhance an organization's ability to detect, respond to, and recover from cyber incidents, reducing the impact on operations and reputation. Furthermore, the report examines the role of cyber resilience frameworks in enhancing organizational agility and adaptability in the face of evolving cyber threats. It discusses the importance of integrating cyber resilience into overall business strategies and the benefits of doing so, such as improved decision-making, resource allocation, and risk management. Finally, the report concludes with a discussion on the future of cyber resilience frameworks, highlighting emerging trends and technologies that are shaping the future of cyber resilience, such as artificial intelligence, machine learning, and automation. It emphasizes the need for organizations to continuously evolve their cyber resilience strategies to keep pace with the evolving threat landscape. In summary, "The Evolution of Cyber Resilience Frameworks in Network Security: A Conceptual Analysis" provides valuable insights into the importance of cyber resilience in modern network security strategies and offers practical guidance for organizations looking to enhance their cyber resilience posture. Keywords: Cyber Resilience, Network, Security, Framework.

“Securing the Digital Frontier: Navigating Cyber Threats in Cloud, Network, and Information Security” offers a comprehensive exploration of the intricate landscape of Cyber security, meticulously designed to equip readers with a robust understanding of contemporary challenges and proactive strategies. With an elaborate Table of Contents spanning thirteen chapters, the book embarks on a journey that starts with laying the groundwork in Chapter 1, providing a holistic Introduction to Cyber security. Here, readers delve into the nuances of the digital realm, tracing the Evolution of Cyber Threats, and comprehending the Historical Milestones that have shaped the field. It underscores the paramount Importance of Cyber security in Modern Society and elucidates the Current State of Cyber security Challenges while speculating on Future Projections and Trends, emphasizing the Interdisciplinary Nature of Cyber security. Moving forward, Chapter 2 delves into the Fundamentals of Information Security, elucidating the CIA Triad – Confidentiality, Integrity, and Availability. It navigates through Risk Management, Compliance, and Regulatory Frameworks, shedding light on Security Policies and Procedures alongside the significance of Security Awareness Training and Incident Response Planning. Subsequent chapters systematically dissect various domains of Cyber security, from Network Security (Chapter 3) to Cloud Security (Chapter 4), Endpoint Security (Chapter 5), and Identity and Access Management (Chapter 6). Each chapter meticulously examines core concepts, methodologies, and best practices essential for fortifying digital infrastructures against evolving threats. The discourse extends to Data Protection (Chapter 7), Threat Intelligence and Detection (Chapter 8), and Incident Response and Management (Chapter 9), offering invaluable insights into encryption techniques, threat hunting strategies, and incident triage frameworks. Furthermore, Security Operations and Monitoring (Chapter 10) elucidates the pivotal role of Security Operations Centers (SOCs), Vulnerability Management, and Red Team vs. Blue Team Exercises in bolstering cyber defenses. Chapter 11 ventures into Emerging Technologies and Threats, contemplating the security ramifications of IoT, AI, Quantum Computing, Block chain, AR, VR, and Biometric Authentication. Meanwhile, Chapter 12 explores the realm of Ethical Hacking and Penetration Testing, unraveling methodologies for ethical hacking, vulnerability assessment, and social engineering mitigation. Finally, Chapter 13 prognosticates on Future Trends and Challenges, accentuating the imperative of addressing the Skills Gap, fostering Global Collaboration, and navigating Regulatory Challenges amidst burgeoning technological advancements. It underscores the ethical considerations paramount in Cyber security endeavors while advocating for resilience-building strategies against escalating cyber threats. In essence, “Securing the Digital Frontier” transcends the realms of a conventional Cyber security manual, emerging as an indispensable compendium for Cyber security professionals, aspiring enthusiasts, and stakeholders navigating the ever-evolving digital ecosystem. It amalgamates theoretical insights with practical wisdom, empowering readers to navigate the complex terrain of cyber threats with confidence and acumen.

-This paper puts forward a full Zero-Day Cybercrime Response Framework aimed at India. It requires Digital Service Providers, or DSPs, to hand over requested metadata to investigators in just 30 minutes. The setup pulls together legal, technical, operational, and enforcement parts to speed up law enforcement against new cyber-attacks. It draws from India's current IT laws, like the IT Act from 2000 and the IT Rules of 2021, plus newer stuff such as the Data Protection Act of 2023 and CERT-In guidelines. This way, DSPs meet quick data demands while still protecting privacy. Main pieces involve automatic spotting of incidents, safe ways to get data, and checks from groups like CERT-In, the Ministry of Home Affairs or MHA, and the National Cybercrime Reporting Portal, known as NCRP. We look at how this stacks up against other countries' approaches, say China's Cybersecurity Law, the EU's e-evidence system along with GDPR, and US methods including the CLOUD Act and tools for endpoint detection. From that, we pull useful ideas and make sure it fits global norms. Figure 1 shows a flowchart of the whole process. We spot likely problems, things like data staying local, court supervision, and issues across borders. Then we talk about fixes, using AI for analysis, legal protections, and deals between nations. Overall, our look shows that a solid 30-minute rule for metadata, backed by tech automation and clear rules, could really boost India's handling of cybercrimes. And it does this without stepping too hard on personal rights. Key Words: Zero-day vulnerability, zero-day exploit, zero-day attack, zero-day malware, unpatched flaw, novelty exploit, zero-day disclosure, exploit marketplace, advanced persistent threat, signatureless detection, heuristic detection, anomaly detection, patch management, exploit stockpiling, software supply chain, weaponised vulnerability, digital forensics, incident response, threat intelligence, exploit mitigation.

The increasing frequency and sophistication of cyber threats have underscored the need for enhanced cybersecurity readiness among organizations in the U.S. and Canada. To address this need, this paper introduces a Cybersecurity Maturity Framework (CMF) designed to assist organizations in systematically assessing and improving their cybersecurity capabilities. The framework provides a structured approach for evaluating current security postures, identifying gaps, and prioritizing investments to mitigate risks effectively. The proposed CMF consists of five maturity levels: Initial, Developing, Established, Advanced, and Optimized. Each level encompasses critical domains, including governance, threat intelligence, incident response, and workforce development, with defined benchmarks to measure progress. By incorporating best practices from the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Canada's Cyber Security Strategy, the CMF ensures alignment with regional regulatory requirements and industry standards. A key feature of the framework is its adaptability to organizations of various sizes and sectors. The CMF integrates advanced technologies such as artificial intelligence (AI) and machine learning (ML) for threat detection and predictive analytics while emphasizing the importance of human factors, including continuous employee training and leadership engagement. Moreover, the framework promotes collaboration between public and private sectors to facilitate information sharing and collective defense against evolving cyber threats. Through case studies, the application of the CMF is demonstrated in enhancing cybersecurity readiness for small and medium enterprises (SMEs) and large organizations in critical sectors such as healthcare, finance, and energy. Results indicate improved incident detection rates, faster response times, and strengthened resilience against sophisticated cyberattacks. This research highlights the necessity of adopting a maturity-based approach to cybersecurity, ensuring organizations can evolve their capabilities to counter dynamic threats. The Cybersecurity Maturity Framework provides a roadmap for sustainable improvement, empowering organizations in the U.S. and Canada to achieve a higher state of preparedness and resilience in the face of an ever-changing cyber threat landscape.

A dedicated cyber risk assessment framework is essential for proactive risk mitigation. The chapter presents a framework that integrates machine learning techniques. It is a data-driven approach to quantitatively assessing cyber risks. In addition, various machine learning models—especially supervised machine learning—are presented. Overall, the chapter makes an innovative contribution to using machine learning to establish a robust and standard cyber risk management system that can be valuable for practitioners in different industries. Given cyber risk's complex, dynamic nature, it is necessary to go beyond typical risk management and technical approaches and incorporate various methods such as threat intelligence, vulnerability management, and incident response. Cyber resilience aims to consistently deliver the intended business outcome even in the face of unfavourable cyber incidents.

The increasing adoption of cloud computing by federal agencies has introduced significant security challenges, necessitating robust strategies to protect sensitive government data. Traditional perimeter-based security models are no longer sufficient against evolving cyber threats, leading to the need for Zero Trust Architecture (ZTA), AI-driven threat intelligence, and compliance with Cybersecurity and Infrastructure Security Agency (CISA) frameworks. This paper explores how artificial intelligence (AI) enhances federal cloud security by enabling adaptive access controls, automated anomaly detection, and real-time threat response. Zero Trust Architecture (ZTA) eliminates implicit trust in network environments by enforcing continuous verification of users, devices, and workloads. AI augments ZTA by leveraging machine learning (ML) algorithms to detect insider threats, automate authentication, and enforce least-privilege access. Additionally, AI-powered threat intelligence systems improve incident detection and response by analyzing vast data streams to identify attack patterns, phishing attempts, and ransomware indicators in real time. Ensuring compliance with CISA’s cloud security directives is essential for safeguarding federal systems against cyber threats. AI-driven compliance automation tools facilitate real-time monitoring of cloud configurations, detect policy violations, and support continuous diagnostics and mitigation (CDM) strategies. By integrating AI with ZTA and threat intelligence, federal agencies can proactively address cloud security risks, reduce attack surfaces, and strengthen their cyber resilience. This study highlights the transformative role of AI in enhancing federal cloud security, emphasizing the need for intelligent automation, predictive analytics, and regulatory alignment to secure critical infrastructures. Future research should focus on refining AI models for adaptive security orchestration, deception techniques, and proactive threat hunting in federal cloud environments